pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies (CVE-2025-69263)

pnpm, a package manager, in versions 10.26.2 and earlier, stores HTTP tarball and git-hosted tarball dependencies in the lockfile without including integrity hashes. This design flaw enables a remote server hosting these tarballs to deliver different content on each installation, even when a lockfile is committed and used. Consequently, an attacker who publishes a package containing an HTTP tarball dependency can manipulate the code served to different users or continuous integration environments, circumventing the expected immutability of the lockfile. The vulnerability is addressed in pnpm version 10.26.0 and later.

An attacker can serve different malicious code to different victims or environments by exploiting the lack of integrity verification for HTTP and git-hosted tarball dependencies in the pnpm lockfile. This undermines the security guarantees of the lockfile, potentially leading to remote code execution or supply chain compromise. The vulnerability affects all users who install packages with HTTP/git tarball dependencies using pnpm versions 10.26.2 and below.

Upgrade pnpm to version 10.26.0 or later, where this vulnerability is fixed. The fix adds integrity hashes for HTTP and git-hosted tarball dependencies in the lockfile, preventing remote content manipulation. No other mitigations are indicated.